miniFlame aka SPE: "Elvis and his friends"
GReAT
Kaspersky Lab Expert
Posted October 15, 11:57 GMT
In May 2012, a Kaspersky Lab investigation detected a new nation-state cyber-espionage malware, which we named "Flame".
Our research also identified some distinguishing features of Flame’s modules. Based on those features, we discovered that
in 2009, the first variant of the Stuxnet worm included a module that was created based on the Flame platform. This confirmed
there was some form of collaboration between the groups that developed the Flame and Tilded (Stuxnet/Duqu) platforms.
A more in-depth research conducted in June 2012 resulted in the discovery of another nation state-sponsored and previously
unknown malware which we named «Gauss». Gauss used a modular structure resembling that of Flame, a similar code base
and system for communicating with command-and-control (C&C) servers, as well as numerous other similarities to Flame.
In partnership with
Symantec, ITU-IMPACT and CERT-Bund/BSI, we also published our analysis of the Flame Command
and Control servers. The analysis showed that the code can understand several communication protocols to talk to different
«clients» or malware:
- OldProtocol
- OldProtocolE
- SignupProtocol
- RedProtocol (mentioned but not implemented)
A close look at these protocol handlers revealed four different types of clients ("malware") codenamed
SP, SPE, FL and IP:
Based on the code logic, we can confirm that the Flame malware was identified as client type "FL". Obviously, this meant there
were at least three other undiscovered cyber-espionage or cyber-sabotage tools created by the same authors: SP, SPE and IP.
Meet SPE, the miniFlame
The SPE malware was uncovered in the course of the ongoing investigation, initiated by International Telecommunication Union
and conducted by Kaspersky Lab.
After we analysed the Flame C2, we were surprised to discover this new module appeared to use OldProtocolE for connections,
which are used by the mysterious SPE malware. We therefore understood the Flame plugin was in fact a unique, standalone
malware: and it was the one known as "SPE" by the Flame C2.
It all started in early July 2012, when we discovered a smaller, interesting Flame module. The module had many similarities with
Flame which led us to believe it was an earlier version of it (all known Flame variants are version 2.x). In the months that followed,
we not only studied the connection of this malware with Flame, but also came across examples of this module being used
concurrently with Gauss and being controlled by the Gauss main module.
miniFlame / SPE details
The SPE malware, which we call "miniFlame", is a small, fully functional espionage module designed for data theft and direct
access to infected systems. If Flame and Gauss were massive spy operations, infecting thousands of users, miniFlame/SPE
is a high precision, surgical attack tool.
miniFlame is in fact based on the Flame platform but is implemented as an independent module. It can operate either
independently, without the main modules of Flame in the system, or as a component controlled by Flame.
It is also notable that miniFlame can be used in conjunction with another espionage program, namely Gauss. As many readers
will remember, it has been assumed that Flame and Gauss were parallel projects that did not have any modules or C&C servers
in common. The discovery of miniFlame, which works with both these espionage projects, proves that we were right when we
concluded that they had come out of the same ‘cyber-weapon factory’.
Apparently, the development of miniFlame began several years ago and continued through 2012. Based on the C&C code, the
protocols serving SP and SPE were created before or at the same time as the communication protocol used by FL (Flame),
i.e., in 2007 at the least.
We believe that the developers of miniFlame created dozens of different modifications of the program. At this time, we have
"only" found six of these, dated 2010-2011.
In some cases, dedicated C&C servers were used exclusively to control the SPE operation. Concurrently with that, some SPE
variants worked with the servers which communicated with Flame.
miniFlame/SPE is different from Flame and Gauss in that the number of infections is significantly smaller. While we estimate the
total number of Flame/Gauss victims at no less than 10,000 systems, SPE has been detected in just a few dozen systems in
Western Asia. This indicates that SPE is a tool used for highly targeted attacks, and has probably been used only against very
specific targets that have the greatest significance and posing the greatest interest to the attackers.
Unlike Flame, where the vast majority of incidents were recorded in Iran and Sudan, and unlike Gauss, which was mostly present
in Lebanon, SPE does not have a clear geographical bias. However, we believe that the choice of countries depends on the SPE
variant. For example, the modification known as «4.50» is mostly found in Lebanon and Palestine. The other variants were reported
in other countries, such as Iran, Kuwait and Qatar.
The original SPE distribution vector is unknown. However, since it is known to have worked both as part of Flame and as part of
Gauss and since it shares its C&C servers with Flame, we believe that in most cases SPE was installed from C&C servers onto
systems that were already infected with Flame or Gauss.
The link with Gauss
The SPE/miniFlame malware is unique in a sense that it can work either as a stand-alone program, as a Flame plugin or as a Gauss
plugin. Essentially, it is a link connecting the Flame and Gauss projects tighter, while remaining independent of them. It uses either its
own C&C servers or common servers with Flame.
In total, we detected six different versions of SPE. All of them were created over the period from 1 October 2010 to 1 September
2011.
At the time of writing, version 4.50 is the most widespread in the wild.
Sinkhole statistics
During our investigations, we were able to sinkhole several of the Flame C&C domains as well as several miniFlame domains.
The statistics below are for miniFlame connections only.
Between 28th of May 2012 and September 30th, we counted close to 14,000 connections in total, coming from about 90 different
IPs.
Distribution of IPs of infected victims:
We have traced the IPs in the United States to VPN connections. Similarly, the IP in Lithuania belongs to an ISP which provides
satellite internet services in Lebanon. The IPs in France are the most curious ones – some do appear to be proxies or VPNs, but
others are not so obvious.
For instance, one of the IPs of victims in France belongs to Francois Rabelais University of Tours:
Other IPs in France belong to mobile internet users or free internet users.
Overall, it seems that the two main locations of victims are Lebanon and Iran.
The SPE / miniFlame backdoor:
The main purpose of miniFlame is to act as a backdoor on infected systems, allowing direct control by the attackers.
The following commands are understood by the malware:
All the commands are issued through the C&C server and are encrypted with a basic XOR of 10 bytes and an additional layer of
Twofish encryption.
Conclusions
During the analysis of the Flame C&C server side code, we identified four different malware files known to the server:
SP, SPE,
FL and
IP. The malware known as FL is Flame. Today, we are announcing the discovery of the malware known as
SPE.
Based on our analysis, we have been able to put together several main points of SPE which we also dubbed the
"miniFlame",
or
"John", as named by the corresponding Gauss configuration:
- The miniFlame malware is not widespread. It is probably deployed only on a very small number of "high profile"
victims. - Unlike Gauss, SPE/miniFlame implements a full client/server backdoor, which allows the operator direct access the
infected system. - The Flame C&C code we’ve analysed does not appear to contain specific modules to control SPE clients; we can assume
other dedicated SPE C2 servers exist or existed, with its own special codebase. - The development of SPE was carried out in parallel to Flame and Gauss, during 2010-2011.
- Both Flame and Gauss make use of miniFlame/SPE as a module.
- The most recent variant of SPE is 5.00; the earliest known one is 4.00.
- The exact infection vector for SPE is unknown; it is believed that the malware gets deployed from the Command and
Control server during Flame or Gauss infections. - Version 4.20 of the malware contains a debug path in the binary which points to "C:\projects\e\SP4.2\general_vob\sp\
Release\icsvnt32.pdb". This indicates the author named the malware "SP4.2", although it uses the "SPE" client type in
C2 parlance. It is possible that SP is simply an earlier version of miniFlame/SPE (v1.00 to v3.xx). - SPE/miniFlame consolidates the theory of a strong link between Flame and Gauss teams. The miniFlame represents a
common module used by both. - All known 4.xx versions of SPE contain a version info section which references code page 3081, ENG_AUS, English
(Australia)
If Flame and Gauss were massive spy operations, infecting thousands of users, SPE/miniFlame is a
high precision espionage
tool. The numbers of its victims is comparable to
Duqu.
We can assume this malware was part of the Flame and Gauss operations which took place in multiple waves. First wave: infect
as many potentially interesting victims as possible. Secondly, data is collected from the victims, allowing the attackers to profile
them and find the most interesting targets. Finally, for these "select" targets, a specialized spy tool such as SPE/miniFlame is
deployed to conduct surveillance/monitoring.
Within the Flame C&C code, two other malware files are referenced: SP and IP. If SP probably refers to an older variant of the
malware described in this paper, IP is probably different and still remains unknown. According to the C2 source code, IP is also
the most recent malware from the pack.
With Flame, Gauss and miniFlame, we have probably only scratched surface of the massive cyber-spy operations ongoing in the
Middle East. Their true, full purpose remains obscure and the identity of the victims and attackers remain unknown.
You can read our Full Technical Paper on SPE / miniFlame
here.
Kaspersky Lab would like to thank CERT-Bund/BSI for their kind assistance with this investigation.
https://www.securelist.com/en/blog/...and_his_friends
ראשי
צ'אט
16-10-2012, 15:43
(קרדיט למרשי)
מצב כלאיים
